Security scanner for AI-generated apps

The idea

Lovable, Bolt and Cursor have produced a generation of shipped apps written by people who cannot read the code they deployed, and the failure modes are stereotyped: secret keys in client bundles, Supabase tables with RLS off, auth enforced only in the UI. The horror threads about leaked service-role keys recur monthly, and each one mints a cohort of frightened founders searching for exactly this.

Generic SAST tools exist and are useless here, because their output assumes a reader who knows what CWE-798 means and can edit code. The wedge is the output format: every finding ships as a fix prompt the user pastes back into the same AI tool that wrote the bug. That closes the loop for someone whose only interface to their codebase is a chat box.

Who pays

The buyer is a vibe-coder who just shipped, often just launched publicly, and just read a thread about someone’s database getting dumped. Fear-driven, one-off purchases at 29 to 49 dollars a scan fit that psychology better than a subscription. Distribution: a free URL-level check as the viral hook, replies and launch posts in the Lovable/Bolt communities and X build-in-public circles, and SEO on is my lovable app secure style queries.

MVP scope

• Repo scan: hardcoded secrets, committed .env history, open storage buckets, missing RLS, client-only auth checks
• Live URL probe for exposed env files, source-map leaks and anonymous-readable endpoints
• Claude-verified severity ranking to suppress false positives
• Findings rendered as copy-paste fix prompts for Lovable/Bolt/Cursor
• Free lightweight check plus paid full scans via Stripe checkout
• Skip for v1: continuous monitoring, dependency CVE auditing, languages beyond JS/TS, pen-testing claims, compliance report exports

Build ShipCheck, a security scanner for AI-generated apps aimed at non-security-literate builders. Stack: Next.js, Claude API for analysis and fix generation, Supabase for auth, scan storage and payments records (Stripe checkout links for per-scan purchases).

Core flow: user pastes a public GitHub repo URL (or connects GitHub OAuth for private repos) or a deployed site URL. For repos: clone shallowly server-side, run deterministic checks first (regex plus entropy scan for hardcoded API keys and service-role tokens, .env files committed to history, Supabase/Firebase config with public buckets, CORS wildcard, missing RLS inferred from schema files, auth checks that exist only in client components). For live URLs: probe for exposed .env, source maps leaking secrets, open Supabase REST endpoints answering anonymous queries. Then feed flagged files to the Claude API to confirm exploitability and rank severity, cutting false positives.

The report is the product: each finding gets a severity, a plain-English explanation of what an attacker does with it, and crucially a fix formatted as a prompt the user pastes straight back into Lovable, Bolt or Cursor, e.g. Move the Stripe secret key from src/lib/stripe.ts into a server-side environment variable and never reference it in client components.

Pages: landing with a free lightweight URL check as the hook, scan results page with shareable private link, scan history dashboard, buy-credits page.

Pricing: free surface-level URL check; full repo scan 29 GBP; 3-scan pack 49 GBP.